I'm trying to figure out if it's possible while listening to the network to read URLs from the traffic.
Since privatebin uses the encryption key in the URL, what process could be in use to prevent spies to see the full URL?
I opened wireshark and checked what happens when I open an encrypted paste: I was surprised I couldn't see any full URL (only domains).
So it's a bit comforting, but I want to be sure I understand how I'm protected. Can you please confirm my understanding is good?
I launch my request to access the paste with the full URL containing the key.
- a DNS request is launched to find the IP of the domain, if I have DoH I only see TLS traffic and not even the domain name is leaked to MITM eyes.
- when my computer has the IP of the domain, a TLS tunnel is mounted.
- inside the TLS tunnel http requests are being sent and received, the ones with full URLs (and therefore paste keys).
Am I right? Also if the privatebin wbesite was not using HTTPS (only HTTP) I guess I would be able to see encryption keys right?